161-java-profiling-detect

Pass

Audited by Gen Agent Trust Hub on Aug 1, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The script profile-java-process.sh interacts with the system by executing the async-profiler binary (asprof) and standard JDK utilities including jcmd, jps, jstat, and jstack to gather metrics. It also includes a management feature to terminate the targeted Java process using the kill command.\n- [COMMAND_EXECUTION]: The run-java-process-for-profiling.sh script automates build and execution tasks by spawning mvn (Maven) and java processes with specific profiling configurations.\n- [EXTERNAL_DOWNLOADS]: The skill requires an external binary distribution of async-profiler. Security risks are mitigated by the script's requirement for a 'trusted, pre-installed distribution' and the explicit refusal to download binaries at runtime.\n- [DATA_EXFILTRATION]: While the skill does not transmit data externally, it generates detailed runtime artifacts like JFR recordings and thread dumps. These files can expose sensitive application state and should be handled according to organizational data policies.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 1, 2026, 11:01 AM
Security Audit — agent-trust-hub — 161-java-profiling-detect